Certified Application Developer CAD Book

The statements that must evaluate to true for a user to pass an Access Control are:

Conditions configured in the Access Control must evaluate to true.

The user has one of the roles specified in the Required roles related list.

Scripts configured in the Access Control must evaluate to true.

An Access Control is a rule that determines whether a user can access a particular object or operation in ServiceNow. An Access Control consists of three elements: Conditions, Roles, and Script. Each element specifies a requirement that the user must meet to access the object or operation. If any of these elements return false, the Access Control denies access and stops evaluating the remaining elements. Therefore, for a user to pass an Access Control, all three elements must evaluate to true.

The other statements are not required for a user to pass an Access Control. Other matching Access Controls for the records do not need to evaluate to true, as only one matching Access Control needs to return true for access to be granted. The user does not need to be granted access through a business rule, as business rules are not part of Access Controls and do not affect their evaluation. Reference: Access control rules, Access Controls

The purpose of application scoping is NOT to provide a way of tracking the user who developed an application. Application scoping does not store or display information about the user who created or modified an application or its artifacts. The purpose of application scoping is to provide a relationship between application artifacts, provide a namespace to prevent cross-application name collisions, and provide controls for how scripts from another scope can alter tables in a scoped application. References: [Product Documentation | ServiceNow], [Advantages of Scoped Applications in ServiceNow]